mirror of
https://github.com/fscotto/infra.git
synced 2026-09-27 19:03:47 +00:00
82 lines
2.7 KiB
YAML
82 lines
2.7 KiB
YAML
---
|
|
# Keep Atlas management gates disabled until the NAS and required Vault inputs are ready.
|
|
hostname: atlas
|
|
ansible_host: 192.168.178.55
|
|
ansible_user: "{{ atlas_connection_username }}"
|
|
ansible_port: 22
|
|
ansible_ssh_private_key_file: /home/fscotto/.ssh/id_ed25519
|
|
|
|
atlas_admin_username: admin
|
|
atlas_connection_username: "{{ atlas_admin_username }}"
|
|
atlas_admin_group: "{{ atlas_admin_username }}"
|
|
atlas_admin_home: "/home/{{ atlas_admin_username }}"
|
|
atlas_admin_uid: 1000
|
|
atlas_admin_gid: 1000
|
|
atlas_admin_ssh_keys: "{{ vault_atlas_authorized_ssh_keys | default([]) }}"
|
|
atlas_admin_password_hash: "{{ vault_atlas_admin_password_hash | default('!') }}"
|
|
|
|
atlas_lan_subnet: 192.168.178.0/24
|
|
atlas_aegis_ip: 192.168.178.54
|
|
atlas_manage_firewall: false
|
|
atlas_firewalld_zone: public
|
|
atlas_zfs_pool: zpool
|
|
atlas_zfs_dataset_work: work
|
|
atlas_zfs_dataset_archive: archive
|
|
atlas_zfs_dataset_music: media/music
|
|
atlas_zfs_dataset_syncthing: syncthing
|
|
atlas_zfs_dataset_backup_prometheus: backup_prometheus
|
|
atlas_zfs_dataset_icloud_photos: media/icloud_photos
|
|
atlas_zfs_dataset_service_backups: backups/services
|
|
atlas_mount_root: /zpool
|
|
atlas_manage_storage: false
|
|
atlas_manage_media_stack: false
|
|
|
|
rocky_manage_openzfs_repo: true
|
|
rocky_manage_syncthing_binary: true
|
|
rocky_manage_podman: true
|
|
rocky_podman_packages:
|
|
- podman
|
|
|
|
host_packages:
|
|
- cockpit
|
|
- nfs-utils
|
|
- policycoreutils-python-utils
|
|
- samba
|
|
- samba-client
|
|
- samba-common-tools
|
|
- zfs
|
|
|
|
atlas_nfs_exports:
|
|
- path: "{{ atlas_icloud_photos_mountpoint }}"
|
|
client: "{{ atlas_aegis_ip }}"
|
|
options:
|
|
- rw
|
|
- sync
|
|
- no_subtree_check
|
|
- all_squash
|
|
- "anonuid={{ atlas_immich_uid }}"
|
|
- "anongid={{ atlas_immich_gid }}"
|
|
|
|
atlas_samba_share_name: Archive
|
|
atlas_samba_workgroup: WORKGROUP
|
|
# Append any pre-existing laptop Unix account here and keep its Samba password in Vault.
|
|
atlas_samba_accounts:
|
|
- username: "{{ atlas_admin_username }}"
|
|
password: "{{ vault_atlas_samba_password | default('') }}"
|
|
atlas_samba_valid_users: "{{ atlas_samba_accounts | map(attribute='username') | list }}"
|
|
|
|
atlas_immich_db_password: "{{ vault_atlas_immich_db_password | default('') }}"
|
|
|
|
atlas_firewalld_rich_rules:
|
|
- 'rule family="ipv4" source address="{{ atlas_lan_subnet }}" service name="ssh" accept'
|
|
- 'rule family="ipv4" source address="{{ atlas_lan_subnet }}" service name="cockpit" accept'
|
|
- 'rule family="ipv4" source address="{{ atlas_aegis_ip }}" service name="nfs" accept'
|
|
- 'rule family="ipv4" source address="{{ atlas_lan_subnet }}" service name="samba" accept'
|
|
- 'rule family="ipv4" source address="{{ atlas_lan_subnet }}" service name="http" accept'
|
|
- 'rule family="ipv4" source address="{{ atlas_lan_subnet }}" service name="https" accept'
|
|
|
|
host_enabled_services:
|
|
- sshd
|
|
- cockpit.socket
|
|
- zfs.target
|